What is the CVSS score of CVE-2026-30655?

CVE-2026-30655 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30655?

Organizations using esiclivre/esiclivre should be aware of notable risk from CVE-2026-30655, a SQL injection vulnerability rated CVSS 6.5.

How to fix or mitigate CVE-2026-30655?

Within 30 days: Identify affected systems running esiclivre/esiclivre and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-30655

EUVD-2026-14891 MEDIUM

SQL Injection (CWE-89)

2026-03-24 mitre

GHSA-jq3j-49mj-6p88

SQLi PHP Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 15:15 euvd

EUVD-2026-14891

Analysis Generated

Mar 24, 2026 - 15:15 vuln.today

CVE Published

Mar 24, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

SQL injection in Solicitante::resetaSenha() in esiclivre/esiclivre v0.2.2 and earlier allows unauthenticated remote attackers to gain unauthorized access to sensitive information via the cpfcnpj parameter in /reset/index.php

AnalysisAI

SQL injection in the password reset function of ESICLivre v0.2.2 and earlier allows unauthenticated attackers to extract sensitive data by manipulating the cpfcnpj parameter. The vulnerability requires no user interaction and can be exploited remotely over the network, though no patch is currently available.

Technical ContextAI

The vulnerability exists in a PHP-based application (esiclivre) within the password reset handler. The cpfcnpj parameter, which typically contains a Brazilian CPF (Cadastro de Pessoa Física) or CNPJ (Cadastro Nacional da Pessoa Jurídica) identifier, is passed unsanitized to a SQL query in the resetaSenha() method. This represents a classic SQL injection vulnerability (CWE type, root cause class involving improper neutralization of special elements used in SQL commands). The affected CPE indicates a generic application product, and the GitHub repository (esiclivre/esiclivre) confirms this is open-source PHP software. The authentication bypass occurs because the password reset endpoint requires no prior authentication, and SQL injection allows an attacker to manipulate query logic to bypass credential validation.

RemediationAI

Upgrade esiclivre to a patched version newer than 0.2.2 immediately; check the official GitHub repository (https://github.com/esiclivre/esiclivre) for the latest stable release and security advisories. The primary remediation is patching, which should include parameterized SQL queries or prepared statements to neutralize SQL injection in the resetaSenha() method. Until patching is completed, implement input validation and sanitization on the cpfcnpj parameter to accept only valid CPF/CNPJ formats (11-14 digits), disable or restrict network access to the /reset/index.php endpoint at the web server or reverse proxy level, and consider implementing Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the cpfcnpj parameter. Review database user permissions to ensure the application database account has minimal necessary privileges to limit data exposure if injection occurs.